From 4790078ff9bfab3fa2ca9133d8c8cb9aeb81e65f Mon Sep 17 00:00:00 2001
From: ashisgreat22 <dev@ashisgreat.xyz>
Date: Wed, 18 Mar 2026 21:54:34 +0100
Subject: [PATCH] Fix CrowdSec GeoIP filter syntax

---
 modules/crowdsec.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/crowdsec.nix b/modules/crowdsec.nix
index 4b15ce9..eeba0e8 100644
--- a/modules/crowdsec.nix
+++ b/modules/crowdsec.nix
@@ -93,7 +93,7 @@ in
       localConfig.profiles = [
         {
           name = "block_non_de";
-          filters = [ "Alert.Remediation == true && Alert.GetScope() == 'Ip' && Alert.Enriched.IsoCode != 'DE' && Alert.Enriched.IsoCode != ''" ];
+          filters = [ "Alert.Remediation == true && Alert.GetScope() == 'Ip' && Alert.Source.Cn != 'DE' && Alert.Source.Cn != ''" ];
           decisions = [
             {
               type = "ban";